Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,321 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-118377 | 8.7 High | mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks | Oct 28, 2026 |
| CVE-2026-118376 | 6.0 Medium | WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses | Oct 28, 2026 |
| CVE-2026-118375 | 9.2 Critical | llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() | Oct 28, 2026 |
| CVE-2026-118374 | 8.2 High | LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response | Oct 28, 2026 |
| CVE-2026-118373 | 6.3 Medium | LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() | Oct 28, 2026 |
| CVE-2026-118372 | 6.3 Medium | LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path | Oct 28, 2026 |
| CVE-2026-118371 | 6.3 Medium | LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line | Oct 28, 2026 |
| CVE-2026-118370 | 8.2 High | libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes | Oct 28, 2026 |
| CVE-2026-117610 | 8.2 High | libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser | Oct 28, 2026 |
| CVE-2026-117609 | 7.1 High | rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder | Oct 28, 2026 |
| CVE-2026-117608 | 6.9 Medium | Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow | Oct 28, 2026 |
| CVE-2026-117607 | 8.6 High | Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import | Oct 28, 2026 |
| CVE-2026-117606 | 5.3 Medium | NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions | Oct 28, 2026 |
| CVE-2026-117605 | 5.3 Medium | nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers | Oct 28, 2026 |
| CVE-2015-20129 | 8.6 High | CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/ | Oct 28, 2026 |
| CVE-2014-125138 | 8.7 High | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields | Oct 28, 2026 |
| CVE-2014-125137 | 7.1 High | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php | Oct 28, 2026 |
| CVE-2014-125136 | 8.2 High | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup | Oct 28, 2026 |
| CVE-2013-20009 | 4.8 Medium | Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter | Oct 28, 2026 |
| CVE-2013-20008 | 7.0 High | Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password | Oct 28, 2026 |
| CVE-2013-20007 | 8.6 High | Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi | Oct 28, 2026 |
| CVE-2026-118272 | 5.3 Medium | a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure | Oct 28, 2026 |
| CVE-2026-106013 | 9.8 Critical | Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter | Oct 28, 2026 |
| CVE-2026-118271 | 5.3 Medium | a2ui-project a2ui data-context Resolver data-context.ts resource consumption | Oct 28, 2026 |
| CVE-2026-110879 | 9.8 Critical | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) | Oct 28, 2026 |
| CVE-2026-110747 | 7.5 High | jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload | Oct 28, 2026 |
| CVE-2026-106972 | Not scored | Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested,… | Oct 28, 2026 |
| CVE-2026-106971 | Not scored | An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service via crafted MessagePack input when the application runs on 32-bit PHP | Oct 28, 2026 |
| CVE-2026-104016 | 7.5 High | jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError | Oct 27, 2026 |
| CVE-2026-118129 | 5.3 Medium | jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication | Oct 27, 2026 |
| CVE-2026-118338 | 8.8 High | Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Oct 27, 2026 |
| CVE-2026-118312 | 9.6 Critical | Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | Oct 27, 2026 |
| CVE-2026-118319 | 4.3 Medium | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118309 | 9.6 Critical | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118356 | 8.8 High | Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118315 | 8.8 High | Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118330 | 8.8 High | Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118341 | 8.8 High | Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118347 | 8.8 High | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118314 | 8.8 High | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118308 | 9.6 Critical | Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118335 | 8.8 High | Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118310 | 9.6 Critical | Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118342 | 9.6 Critical | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118346 | 8.8 High | Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118316 | 9.6 Critical | Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118304 | 8.8 High | Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118345 | 8.8 High | Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118313 | 8.8 High | Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
| CVE-2026-118332 | 9.6 Critical | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 27, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.